tstack
commented
3 years ago It looks like you'll probably need to modify the format a bit or create a new format. What version of lnav are you using?
For reference, the access_log format file is here:
https://github.com/tstack/lnav/blob/master/src/formats/access_log.json
You could try install the following format file fragment which tries to capture the country code:
{
"access_log": {
"regex": {
"with-geoip": {
"pattern": "^(?<c_country_code>\\w{2}) (?<c_ip>[\\w\\.:\\-]+)\\s+[\\w\\.\\-]+\\s+(?<cs_username>\\S+)\\s+\\[(?<timestamp>[^\\]]+)\\] \"(?:\\-|(?<cs_method>\\w+) (?<cs_uri_stem>[^ \\?]+)(?:\\?(?<cs_uri_query>[^ ]*))? (?<cs_version>[\\w/\\.]+))\" (?<sc_status>\\d+) (?<sc_bytes>\\d+|-)(?: \"(?<cs_referer>[^\"]+)\" \"(?<cs_user_agent>[^\"]+)\")?\\s*(?<body>.*)"
}
},
"value": {
"c_country_code": {
"kind": "string",
"identifier": true
}
}
}
}You can install it by copying the above snippet into a file named "access_log_with_country_code.json" and copying it into `~/.lnav/formats/installed". You might have to edit hte "with-geoip" pattern to match your log files. If you can provide some anonymized log messages, I can help with that.
(Sorry for the late response)
EmJotGeh
I've made a change to the apache log format.
from: LogFormat "% h% l% u% t \"% r \ "%> s% O \"% {Referer} i \ "\"% {User-Agent} i \ "" combined
to: LogFormat "% {GEOIP_COUNTRY_CODE} e% a% l% u% t \"% r \ "%> s% O \"% {Referer} i \ "\"% {User-Agent} i \ "" combined
This change has an effect on the lnav log format colors and I can't find out, how to change or extend the colors for the access.log for lnav.
I have read the documentation but I can't find the reference to the access.log for lnav.
Would be very grateful for a hint